2015-11-06 11:34:42 +00:00
|
|
|
/*
|
2016-06-03 00:25:58 +00:00
|
|
|
Copyright 2015 The Kubernetes Authors.
|
2015-11-06 11:34:42 +00:00
|
|
|
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
you may not use this file except in compliance with the License.
|
|
|
|
You may obtain a copy of the License at
|
|
|
|
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
See the License for the specific language governing permissions and
|
|
|
|
limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
package pod
|
|
|
|
|
2017-02-23 05:35:44 +00:00
|
|
|
import "k8s.io/kubernetes/pkg/api"
|
|
|
|
|
|
|
|
// VisitPodSecretNames invokes the visitor function with the name of every secret
|
|
|
|
// referenced by the pod spec. If visitor returns false, visiting is short-circuited.
|
|
|
|
// Transitive references (e.g. pod -> pvc -> pv -> secret) are not visited.
|
|
|
|
// Returns true if visiting completed, false if visiting was short-circuited.
|
|
|
|
func VisitPodSecretNames(pod *api.Pod, visitor func(string) bool) bool {
|
|
|
|
for _, reference := range pod.Spec.ImagePullSecrets {
|
|
|
|
if !visitor(reference.Name) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
for i := range pod.Spec.InitContainers {
|
|
|
|
if !visitContainerSecretNames(&pod.Spec.InitContainers[i], visitor) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
for i := range pod.Spec.Containers {
|
|
|
|
if !visitContainerSecretNames(&pod.Spec.Containers[i], visitor) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
var source *api.VolumeSource
|
|
|
|
for i := range pod.Spec.Volumes {
|
|
|
|
source = &pod.Spec.Volumes[i].VolumeSource
|
|
|
|
switch {
|
|
|
|
case source.AzureFile != nil:
|
2017-02-27 06:00:58 +00:00
|
|
|
if len(source.AzureFile.SecretName) > 0 && !visitor(source.AzureFile.SecretName) {
|
2017-02-23 05:35:44 +00:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
case source.CephFS != nil:
|
|
|
|
if source.CephFS.SecretRef != nil && !visitor(source.CephFS.SecretRef.Name) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
case source.FlexVolume != nil:
|
|
|
|
if source.FlexVolume.SecretRef != nil && !visitor(source.FlexVolume.SecretRef.Name) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
case source.Projected != nil:
|
|
|
|
for j := range source.Projected.Sources {
|
|
|
|
if source.Projected.Sources[j].Secret != nil {
|
|
|
|
if !visitor(source.Projected.Sources[j].Secret.Name) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
case source.RBD != nil:
|
|
|
|
if source.RBD.SecretRef != nil && !visitor(source.RBD.SecretRef.Name) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
case source.Secret != nil:
|
|
|
|
if !visitor(source.Secret.SecretName) {
|
|
|
|
return false
|
|
|
|
}
|
2016-11-19 20:46:23 +00:00
|
|
|
case source.ScaleIO != nil:
|
|
|
|
if source.ScaleIO.SecretRef != nil && !visitor(source.ScaleIO.SecretRef.Name) {
|
|
|
|
return false
|
|
|
|
}
|
2017-03-17 20:42:15 +00:00
|
|
|
case source.ISCSI != nil:
|
|
|
|
if source.ISCSI.SecretRef != nil && !visitor(source.ISCSI.SecretRef.Name) {
|
|
|
|
return false
|
|
|
|
}
|
2017-02-23 05:35:44 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
func visitContainerSecretNames(container *api.Container, visitor func(string) bool) bool {
|
|
|
|
for _, env := range container.EnvFrom {
|
|
|
|
if env.SecretRef != nil {
|
|
|
|
if !visitor(env.SecretRef.Name) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
for _, envVar := range container.Env {
|
|
|
|
if envVar.ValueFrom != nil && envVar.ValueFrom.SecretKeyRef != nil {
|
|
|
|
if !visitor(envVar.ValueFrom.SecretKeyRef.Name) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return true
|
|
|
|
}
|